Operation CameraSwarm exploitation of Dahua authentication-bypass flaws

**CVE-2021-33044** and **CVE-2021-33045** are **authentication-bypass** flaws in **Dahua cameras and related products** that let attackers bypass device identity checks during login. Hunt.io linked the flaws to **Operation CameraSwarm**, which compromised **more than 14,530 Dahua IP cameras** between **June 17 and July 22, 2026** using **TCP/37777 brute-forcing**, **cloud-relay access**, and exploitation of the CVEs to install a persistent **p2pwn** backdoor account on **1,923 cameras**. The researchers also said **283 cameras** were reached through **P2P** and recovered **407 MB** of operator data. **Dahua** lists **fixed firmware**, and **CISA KEV** still tracks both issues as exploited vulnerabilities.

**CISA** kept **CVE-2021-33044** and **CVE-2021-33045** in the **KEV catalog** for **Dahua IP camera authentication-bypass vulnerabilities**, directing defenders to **apply vendor mitigations** or **discontinue use** if mitigations are unavailable. The guidance covers affected **Dahua cameras and related products** as of **August 19, 2026**, leaving exposed systems on notice for urgent remediation.

**Hunt.io** disclosed **Operation CameraSwarm**, a **35-day** campaign that compromised **more than 14,530 Dahua IP cameras** mostly in **Ukraine and Russia**. The operation used **TCP/37777 brute-forcing**, **CVE-2021-33044**, **CVE-2021-33045**, and a **cloud-relay** path that relied on serial numbers and SDK credentials to reach **283 cameras** behind NAT. Hunt.io also reported **1,923 cameras** were configured with a persistent **p2pwn** account, recovered **407 MB** of operator data, and said some toolkit references to **CVE-2024-39943** and **CVE-2025-31702** were misleading and not part of the observed attacks. Owners of affected **Dahua** devices were advised to check for **p2pwn**, disable **P2P** when not needed, and apply **Dahua SA-2021-0130** firmware updates or later versions.